A service that runs shell scripts on receipt of an HTTP request is one input-validation bug away from remote code execution on the box that hosts nine production products.
What I did about it
Kept deliberately tiny — the smallest surface that does the job is the smallest surface an attacker can reach.
Both the API and the console bind loopback-only behind nginx; neither is directly reachable.
Project-to-script mapping is a fixed allowlist, not a path derived from the request.
What I rejected, and why
Small enough that six commits covers it. That is the feature, not a gap.
One test on a service that executes deploy scripts on receipt of an HTTP request. It is deliberately tiny and loopback-only, but the one thing that genuinely deserves a test — the project-to-script allowlist — should have several.